How severe is CVE-2025-15560?

CVE-2025-15560 has a CVSS 3.x base score of 8.8, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2025-15560 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (16th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-15560?

CVE-2025-15560 primarily affects Nestersoft Worktime. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2025-15560?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2025-15560 have an EU (EUVD) identifier?

Yes. CVE-2025-15560 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-207635.

When was CVE-2025-15560 published?

CVE-2025-15560 was published on 2026-02-19 and last updated on 2026-06-17.

CVE-2025-15560

CVE-2025-15560 is a high-severity vulnerability in Nestersoft Worktime with a CVSS 3.x base score of 8.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-89.

Key facts

Severity: High (CVSS 3.x base score 8.8)
EPSS exploit prediction: 0% (16th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-207635
Weakness: CWE-89
Affected product: Nestersoft Worktime
Published: 2026-02-19
Last modified: 2026-06-17

Description

An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpoint to inject SQL queries. If the Firebird backend is used, attackers are able to retrieve all data from the database backend. If the MSSQL backend is used the attacker can execute arbitrary SQL statements on the database backend and gain access to sensitive data.

Frequently asked questions

What is CVE-2025-15560?: An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpoint to inject SQL queries. If the Firebird backend is used, attackers are able to retrieve all data from the database backend. If the MSSQL backend is used the attacker can execute arbitrary SQL statements on the database backend and gain access to sensitive data.
How severe is CVE-2025-15560?: CVE-2025-15560 has a CVSS 3.x base score of 8.8, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2025-15560 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (16th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-15560?: CVE-2025-15560 primarily affects Nestersoft Worktime. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2025-15560?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2025-15560 have an EU (EUVD) identifier?: Yes. CVE-2025-15560 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-207635.
When was CVE-2025-15560 published?: CVE-2025-15560 was published on 2026-02-19 and last updated on 2026-06-17.

References

https://r.sec-consult.com/worktime

Affected products (2)

cpe:2.3:a:nestersoft:worktime:*:*:*:*:cloud:*:*:*
cpe:2.3:a:nestersoft:worktime:*:*:*:*:on-premise:*:*:*

More vulnerabilities in Nestersoft Worktime

CVE-2025-15559 — Critical (CVSS 9.8): An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The…
CVE-2025-15561 — High (CVSS 7.8): An attacker can exploit the update behavior of the WorkTime monitoring daemon to elevate privileges on the local system…
CVE-2025-15562 — Medium (CVSS 6.1): The server API endpoint /report/internet/urls reflects received data into the HTML response without applying proper…
CVE-2025-15563 — Medium (CVSS 5.3): Any unauthenticated user can reset the WorkTime on-prem database configuration by sending a specific HTTP request to…

All CVEs affecting Nestersoft Worktime →

Other CWE-89 (SQL Injection) vulnerabilities

CVE-2026-54350 — Critical (CVSS 10.0): Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase…
CVE-2026-8054 — Critical (CVSS 10.0): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish Audit API endpoints…
CVE-2026-42287 — Critical (CVSS 10.0): Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and…
CVE-2026-3325 — Critical (CVSS 10.0): SQL injection (SQLi) in MegaCMS v12.0.0, specifically in the “id_territorio” parameter of the…
CVE-2025-10878 — Critical (CVSS 10.0): A SQL injection vulnerability exists in the login functionality of Fikir Odalari AdminPando 1.0.1 before 2026-01-26.…
CVE-2025-57792 — Critical (CVSS 10.0): Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of…

Browse all CWE-89 (SQL Injection) vulnerabilities →